Prototype Pollution

tarteaucitron.js is vulnerable to prototype pollution. The vulnerability is due to improper input validation in the addOrUpdate function within the file tarteaucitron.js, which allowed manipulation of JavaScript object prototypes...

CVE-2025-29922

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By...

CVE-2025-0889

Prior to 25.2, a local authenticated attacker can elevate privileges on a system with Privilege Management for Windows installed, via the manipulation of COM objects under certain circumstances where an EPM policy allows for automatic privilege elevation of a user process...

Design/Logic Flaw

User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. The existing switch to disable the feature by default was not effective in this case. Unauthorized users could discover and modify application state, including objects related to other users...

Mozilla: [Hubs] - Broken access control in placing objects in hubs room

A broken access control vulnerability allowed an attacker to bypass object creation and movement restrictions in Mozilla Hubs. By using specific commands in the chat feature, the attacker could place objects in a room even if the admin user had disabled these actions. The vulnerability did not...

CVE-2023-0842 xml2js 0.4.23 - Prototype Pollution

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited...

CVE-2023-0842

CVE-2023-0842 affects xml2js: version 0.4.23 allows prototype pollution by editing proto via unchecked JSON keys. Affected component: xml2js (Node.js). Impact (as stated): attacker could edit/add object properties through prototype pollution. Remediation: upgrade to newer xml2js releases; referen...

1095h-cli (1.0.1), 5coder-pages (0.2.0) +547 more potentially affected by CVE-2023-25344 via swig-templates (>=2.0.2, <=2.0.3)

swig-templates NPM version =2.0.2, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.0, =0.1.0, =1.0.0-beta.1, =0.0.1-alpha.0, =0.0.1 and more Source cves: CVE-2023-25344 Source advisory: SNYK:JS-SWIGTEMPLATES-3266806...

Remote code execution

If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox 102, Firefox ESR 91.11, Thunderbird 102, and Thunderbird 91.11...

@bouzuya/mr-jums (>=0.2.0, <=0.9.1), @deansel/latte (0.1.2-beta.1) +77 more potentially affected by CVE-2022-24999 via qs (>=6.3.0, <=6.3.1)

qs NPM version =6.3.0, =0.2.0, =1.0.0-alpha.7, =0.0.1-alpha.1, =0.0.1-dev.0, =4.0.0-beta.6, =3.0.0, =0.20.5, =0.20.5, =0.20.8, =0.1.5, =0.6.5, =0.13.0, =0.15.0 - app-decorators 0.8.206 and more Source cves: CVE-2022-24999 Source advisory: OSV:GHSA-HRPP-H998-J3PP...

fastest-json-copy vulnerable to Prototype Pollution

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the proto property to be edited...

CVE-2022-41713

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the 'proto' property to be edited...

CVE-2022-41713 deep-object-diff 1.1.0 - Prototype Pollution

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the 'proto' property to be edited...

CVE-2022-21213

This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn mixes objects into the target object, recursively mixing existing child objects as well. In both cases, the key used to access the target object recursively...

@loopspeed/epubjs-rn (>=0.2.38, <=0.2.77), @muriloneo/epubjs-rn (0.2.37) +8 more potentially affected by CVE-2021-33040 via epubjs (>=0.2.21, <=0.3.88)

epubjs NPM version =0.2.21, =0.2.38, =0.3.25, =0.2.33, =0.2.5, =0.1.0, =0.0.9, =0.2.37, =0.13.1, =0.13.2 - unext-epub-viewer 1.0.0 Source cves: CVE-2021-33040 Source advisory: OSV:GHSA-C6RP-XVQV-MWMF...

The vulnerability of the LLHTTP component in the NodeJS object manipulation software, which allows attackers to enhance their privileges.

The vulnerability of the LLHTTP component in the NodeJS object manipulation software lies in inconsistencies during the interpretation of HTTP request headers. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

CVE-2021-24465

The Meow Gallery WordPress plugin before 4.1.9 does not sanitise, validate or escape the ids attribute of its gallery shortcode available for users as low as Contributor before using it in an SQL statement, leading to an authenticated SQL Injection issue. The injection also allows the returned...

@christianhugo/cli (>=0.7.2-beta.6, <=0.7.3-beta.15), @christianhugo/mobile-builder (>=0.7.2-beta.6, <=0.7.4-beta.9) +72 more potentially affected by CVE-2021-23445 via datatables.net (>=1.10.12, <=1.10.25)

datatables.net NPM version =1.10.12, =0.7.2-beta.6, =0.7.2-beta.6, =0.7.2-beta.6, =0.7.2-beta.6, =0.6.4-beta.10, =0.7.2-beta.7, =0.6.4-beta.10, =0.6.4-beta.10, =1.0.0, =1.0.0, =3.0.0, =3.0.11 and more Source cves: CVE-2021-23445 Source advisory: OSV:GHSA-H73Q-5WMJ-Q8PJ...

CVE-2021-3757

A flaw was found in immer when manipulates object attributes such as proto, constructor and prototype. An attacker can manipulate these values by overwriting and polluting them. Those attributes would be inherited by JavaScript objects which could trigger exception handlers and leading into a...

bmoor-cache (>=0.3.0, <=0.6.0), bmoor-comm (>=0.0.1, <=0.6.0) +4 more potentially affected by CVE-2020-7736 via bmoor (>=0.0.5, <=0.5.1)

bmoor NPM version =0.0.5, =0.3.0, =0.0.1, =0.2.0, =0.1.0, =0.0.4, =0.6.0, =0.6.43 Source cves: CVE-2020-7736 Source advisory: OSV:GHSA-H3RX-G5C9-8Q4X...